CVE-2021-29047: Liferay Dxp

High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days.

The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, which allows remote attackers to repeatedly perform actions protected by a CAPTCHA challenge by reusing the same CAPTCHA answer.

Affected products

• Liferay Dxp: before 7.3 (fixed in 7.3); version 7.3 only
• Liferay Liferay Portal: version 7.3.4 only; version 7.3.5 only

Published 2021-05-16. Last modified 2026-07-09.